Subprocessors
MigraTech Pty Ltd — ABN 45 596 350 923
Last updated 5 September 2026
These are the third parties that may process personal information on our behalf when you use MigraTech. Several are optional and receive nothing unless a practice connects them.
Most process data outside Australia. Under Australian Privacy Principle 8 we remain accountable for what an overseas recipient does with information we disclose to them, which is why the location of each is stated rather than left to be assumed.
In use today
Supabase
Singapore (AWS ap-southeast-1)Database, authentication and document storage
Everything a practice stores: client names, dates of birth, passport and visa details, case records, uploaded documents, and agent account credentials
The primary store. Almost all personal information in the product lives here.
Vercel
United States, with edge delivery worldwideApplication hosting, and page performance measurement
Request metadata including IP address, and anything transiting the application in normal use
Stripe
United StatesSubscription billing
Practice billing contact and payment details. Card numbers go to Stripe directly and are never held by us.
Resend
United StatesTransactional email
Recipient addresses and the content of messages we send: onboarding, deadline digests, payment notices, support replies
Anthropic
United StatesAI analysis of visa pathways, skills assessments and requests for information
Case details submitted for analysis, which can include occupation, qualifications, English results and visa history
Sent per request when an agent runs an analysis. Not used to train models.
PostHog
United StatesProduct analytics
Usage events, page views and device metadata
Loaded only where a visitor has accepted analytics cookies.
Sentry
United StatesError monitoring
Error reports, which can incidentally include request context at the moment something failed
Calendar synchronisation, where an agent connects it
Case deadline titles and dates written to the agent's own calendar
Connected per practice. No data is sent unless an agent authorises it.
Microsoft
United StatesOutlook calendar synchronisation, where an agent connects it
Case deadline titles and dates written to the agent's own calendar
Connected per practice. No data is sent unless an agent authorises it.
Xero
New Zealand and AustraliaAccounting, where an agent connects it
Invoice records including client name and amounts
Connected per practice. No data is sent unless an agent authorises it.
n8n
n8n Cloud; region being confirmed — ask us and we will tell youWorkflow automation behind several of the public migrant tools
Profile details submitted to a tool, such as occupation, qualifications and English results
Built but not switched on
Upstash
United StatesRate limiting
Request counters keyed by IP address or account identifier. No case data.
Not currently provisioned. Rate limiting falls back to per-instance memory until it is.
Meta (WhatsApp Business)
United StatesClient messaging over WhatsApp
Message content and phone numbers, where a practice enables it
Built but not switched on. No credentials are configured, so nothing is sent today.
These are listed because the capability exists in the product. No credentials are configured for them, so no data reaches them today. They will move into the list above, and this page will be dated accordingly, before that changes.
Changes
We will update this page before a new subprocessor begins handling personal information. Practices on an enterprise agreement are notified in advance and may object.
Questions about this list, or a request for our data processing terms, can go to the contact in our privacy policy.